What is the CVSS score of EUVD-2026-29407?

EUVD-2026-29407 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

HEL Online Classroom EUVD-2026-29407

| CVE-2026-6708 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-mxgq-qrj9-vj5p

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:45 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 5.3

DescriptionCVE.org

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission_callback of '__return_true', which bypasses all WordPress authentication and authorization checks. This makes it possible for unauthenticated attackers to delete any classroom record by supplying its ID in the request, resulting in permanent data loss.

AnalysisAI

Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1.0.3) via a REST API endpoint that bypasses all WordPress authentication checks through a permission_callback set to '__return_true', resulting in permanent data loss. The vulnerability affects the plugin's core functionality and requires only network access with no user interaction, though the CVSS score of 5.3 reflects limited confidentiality impact (integrity modification only, no information disclosure).

Technical ContextAI

The HEL Online Classroom plugin registers REST API endpoints with a permission_callback function set to '__return_true', which unconditionally returns true and bypasses WordPress's built-in capability checking system (wp_is_user_logged_in and current_user_can functions). WordPress REST API endpoints typically enforce authentication through capability checks; this plugin explicitly disables that enforcement. The CWE-862 classification (Missing Authorization) indicates the underlying flaw: the endpoint accepts requests without verifying the user's role or capabilities, allowing any HTTP request-including from unauthenticated sources-to trigger destructive actions. The affected CPE string identifies HigherEdLab's plugin in the WordPress plugin ecosystem.

RemediationAI

Update the HEL Online Classroom plugin to a version newer than 1.0.3 once released by HigherEdLab; patch version number not provided in available sources. Immediately after patching, audit the WordPress database for classroom records deleted between the plugin installation date and the update, as deletion is permanent without backups. As a temporary workaround pending patch availability, restrict REST API access to authenticated users by adding a WAF rule or server-level filter to block unauthenticated requests to endpoints containing 'hel-online-classroom' or 'classroom' (trade-off: may block legitimate automated integrations), or disable the HEL Online Classroom plugin entirely until a patched version is available. Monitor WordPress logs and REST API access logs for DELETE requests to classroom endpoints from unknown or unauthenticated sources. Refer to Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0612c0be-f1c0-4f74-a769-e4616f103ee6 for updates on patch availability.